NSA Surveillance: IT Pro Survey Says What?

To understand the relationship between security and privacy, we should pay more attention to IT professionals and spend less time asking loaded questions.

A majority of Americans who don't understand security find the National Security Agency's use of secret court orders to collect phone and email data acceptable. IT professionals, however, see things differently.

When the Washington Postpublished the results of a Pew Research poll on the subject last month, it concluded that most Americans (56%) accept NSA data collection, even at the expense of privacy, as a defense against terrorism. But it didn't characterize its 1,004 survey respondents as ignorant about computer security.

Stu Sjowerman, CEO of security training firm KnowBe4.com, did so indirectly. He posed the same survey questions, via SurveyMonkey, to more than 1,500 IT professionals — people who do understand computer security — and came to the opposite conclusion. In Sjowerman's survey, some 70% said the NSA's actions were unacceptable, compared to 41% in the Washington Post-Pew survey.

Sjowerman, in a phone interview, said he decided to replicate the Post-Pew survey because he "didn't think that people really understand the implications [of the NSA's data gathering], especially long term."

There are two major issues. "One, if you do this kind of dragnet long-term," said Sjowerman, "you're creating a profile of everyone in the U.S. That is totally, as far as I'm concerned, violating the Fourth Amendment. Two, the U.S. government doesn't have a very good record of keeping everything secure. There will be data breaches."

Some 654 respondents offered a written explanation of their thoughts on the matter. Their answers for the most part echo Sjowerman's views.

"Too many law enforcement agencies have demonstrated they cannot be trusted and often put themselves above the law to achieve their goals," said respondent #4. "Those goals are not always in the best interests of citizens, but more often seem to favour large corporations or the rich and powerful."

Respondent #231 wrote, "Law enforcement officials do have a legitimate need to access some private information and communication, but such access must always be authorized beforehand by a properly executed warrant, limited to a very specific scope and duration, conducted under the oversight of the judge who issued that warrant, and cannot be done off record under a veil of secrecy. The rights of the people must not be trampled under a stampede towards security."

There are other viewpoints too, some who gladly surrender their privacy for what they perceive as security and others who see negligence in the intelligence community and its contractors for allowing Edward Snowden, the 29-year-old fugitive whistleblower responsible for exposing the scope of the NSA's activities, access to so much information.

But the takeaway here is that all surveys are not created equal. It's doubtful anyone would seek surgical advice from bar patrons, parachuting instruction from preschoolers or nautical knowledge from those who shun the sea. Asking average Americans their views on NSA data collection just isn't good enough. Some domain experience is necessary to reach an informed conclusion.

And not all questions are created equal. Consider this question, posed both by Pew and Sjowerman: "As you may know, it has been reported that the National Security Agency has been getting secret court orders to track telephone call records of MILLIONS of Americans in an effort to investigate terrorism. Would you consider this access to telephone call records an acceptable or unacceptable way for the federal government to investigate terrorism?"

The problem is that once you throw "terrorism" into the mix, the discussion ends. Only terrorists support terrorism, right? But as others have noted, the chance of being killed in a terrorist attack is extremely low. Reason in 2011 put it at one in 20 million, noting that in the past five years a person would be four to five times more likely to be killed by lightning than by a terrorist. (The recent Boston bombing may have shifted the odds a tiny bit.)

Would the average American be as accepting of the NSA's data gathering if the stated reason were to protect people from a bolt from above? Or imagine a much more hostile U.S. administration. Recall that President Nixon kept an enemies list. With the data squirreled away on NSA servers, imagine what one could do.

Then again, imagination is the real problem here. We imagine a fearful world. We might be better served if we imagined less and listened more to people with real-world privacy experience. To understand the relationship between security and privacy, we should pay more attention to IT professionals and spend less time asking loaded questions. We can find a balance without throwing away the Constitution.

I think you will find the people that agree are more likey to be the ones that voted for the current administration. I haven't seen a lot of Democrats leading the charge to stop this abuse of power. Barring that, your salivating divisive rhetoric is shameful. Every American from all political leanings should unite to resist this attack of our constitutional rights. I will stand with any man or woman, without regard for their politics, to stop this totalitarian policy. That includes you.

Respondent #231 hit the nail on the head. There is a need for law enforcement to obtain some data as a matter of public security, but I would agree that there needs to be a legitimate reason for that access. Collecting a treasure trove of information about citizens -- even those who are not a threat -- does violate constitutional rights, and the laws must be adjusted so as to not allow the government to overstep its boundaries in the name of security. More oversight is definitely needed.

56% of the people agree? That is the same 56% that also are in favor of banning gay marriage, banning abortion (because it kills life), extending the death penalty to petty crimes, having a right-wing extremist Republican as president, and making gun ownership mandatory. Who did the Washington Post ask? The same 1,001 cleverly selected people to get a good headline? Or is the majority of people really that dumb and uninformed?Thankfully, folks in IT see it differently and hopefully they have the guts to object when ordered to provide data to organizations outside of the company. If data doesn't even leave the premises in the first place we do not need heroes like Snowden.

Very good point. Let knowledgeable people in on the operational detail of NSA systems and see what critique, what feedback they can give us. Law enforcement without public watchfulness tends to go outsde the law. With public watchfulness, it's much more accountable. I also agree the chances of being killed in a terrorist act are infinitesimal. On the other hand, note the difference in the second attack on the World Trade Center from the first, where the intent of setting off a van loaded with conventional explosives in the parking garage was to topple the building.The first try failed, What followed was plan B. Soon we'll be at plan C, I regret the circumstance, but at some point, we will want to know everything we can about the plan. Charlie Babcock

Published: 2015-03-31The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.